OpenClaw Main Stops TUI Text Becoming Shell Input or Terminal Control

OpenClaw has merged two TUI boundary fixes for text that was capable of changing meaning between entry and rendering. Whitespace-padded text beginning with ! could be trimmed into executable local-shell syntax, while control characters in system messages could reach the terminal rendering surface.

Both fixes are on main; the supplied packet does not identify a containing package. Operators who use the TUI on privileged workstations should treat input preservation and output sanitization as security acceptance tests, not cosmetic terminal behavior.

Trimming could turn chat into a command

The TUI intentionally supports a bang-prefixed local-shell surface. The dangerous transition was that text not executable as entered could become executable after normalization.

Examples identified upstream include a leading space before !cmd, trailing newlines and newline-padded forms. Submission and history handling could trim those values into exact bang syntax. A user intending to discuss or paste a command could therefore cross from chat data into local execution without authoring the executable form.

PR #119245 preserves the routing-significant whitespace through submit, paste expansion, blocked admission retries and private history. Only text that is executable under the TUI’s authored-input rule should enter the shell path.

Interpretation: normalization must not widen authority. Whitespace cleanup is safe for display only when it cannot convert inert data into a privileged command grammar.

System messages must not program the terminal

PR #118998 addresses the output side. System and status text can contain values derived from sessions, providers, tools or errors. If terminal control sequences survive into rendering, text can alter display state rather than merely appear on screen.

The merged fix blocks terminal controls in system messages. That matters even when no shell process starts: ANSI/OSC-style sequences can hide or rewrite visible evidence, create misleading links, change window metadata or interfere with subsequent prompts depending on terminal support.

A sanitizer must preserve ordinary Unicode, useful newlines and diagnostics while neutralizing control behavior. Simply stripping every non-ASCII character would be a destructive workaround, not a correct fix.

Operator response

Until a containing build is deployed:

• do not paste untrusted text at the beginning of a TUI input where trimming could expose !;
• avoid running the TUI under a more privileged account than the Gateway work requires;
• treat copied logs, provider errors and tool output as untrusted terminal data;
• use a non-production shell and harmless commands for validation; and
• preserve the exact authored bytes when investigating an unexpected local command.

If an unexpected command may have run, inspect shell/process audit evidence and the command’s target side effects before repeating or dismissing it. TUI history after trimming may not be sufficient evidence on an affected build.

Acceptance test

Use a disposable working directory and an inert marker command:

1. submit exact ! syntax and prove the documented local-shell feature still works;
2. submit leading-space, leading-newline and trailing-newline variants and prove they remain chat;
3. repeat through paste expansion and a blocked-then-retried admission path;
4. switch sessions and inspect private history to ensure spacing was not rewritten into executable form;
5. render system-message fixtures containing ANSI, OSC, carriage-return and erase-style controls; and
6. confirm the terminal state and following prompt remain intact while normal Unicode and diagnostics stay readable.

Never use a destructive command merely to prove routing. A command that creates a uniquely named file inside a disposable directory is enough.

Evidence and limits

The official merged PR and commit records establish the trim-to-shell transition, affected submit/history paths and system-message control repair. Upstream reports PTY and focused regression coverage. OpenClaw Academy did not execute a shell command through a live OpenClaw TUI or test every terminal emulator.

Relevant collector IDs are 38094/38065 and 37798/37750.

Bottom line

Chat text must not gain shell authority because a UI trimmed it, and diagnostic text must not gain terminal authority because a renderer displayed it. Identify a containing build and test both directions—input routing and output controls—before returning the TUI to privileged operator workflows.